[scj]

As I understand the GPL, they would need to provide source code to people they distribute binaries to...

So in practice, they are probably complying with the GPL.

[ezoe]

So, If the USA spy infected my computer with malicious Linux kernel module which use GPL protected kernel APIs, Can I demand the source code?

[scj]

You'd probably need to prove they provided the infection.